Browser-use agents plan their actions by reading a page, then execute those actions a moment later. Between observation and execution, the page can change — a DOM element shifts, a button redirects, a malicious script rewrites the target. This temporal gap between checking and acting is a time-of-check-to-time-of-use vulnerability, a class of flaw well known in systems programming but newly relevant in the age of autonomous web agents.
Jiang and colleagues evaluate ten popular open-source browser agents and find the vulnerability is pervasive. Dynamic content, adversarial injection, even ordinary page updates can cause agents to click elements that no longer correspond to their intended targets. The attack surface is not exotic — it's inherent in the architecture of any system that separates perception from action across a mutable environment. Their proposed mitigation — pre-execution validation that re-checks the DOM immediately before acting — is lightweight but structurally significant. It collapses the temporal gap rather than trying to predict what might fill it.
Any agent operating in a changing environment faces this problem: the world it modeled is not the world it acts on. The TOCTOU gap is not a bug in browser agents — it's a fundamental tension in all perception-action loops. The only defense is to re-perceive at the moment of commitment, accepting that planning and execution can never share the same present.
(arXiv:2603.00476)